GitHub Actions pull_request_target runs with write-capable secrets while exposing PR-author-controlled inputs, a supply-chain attack vector

Unlike pull_request, pull_request_target runs against the base branch with the target repository's secrets available, while PR-author-controlled fields (title, body, branch name, head ref) feed inputs. Multiple recent worms (nx s1ngularity 2025-08, TanStack 2026-05) compromised maintainers by injecting via these fields and exfiltrating OIDC tokens or npm credentials from runner memory. TanStack had 2FA, OIDC trusted publishing, and signed provenance, the provenance signed the malicious build because the build itself was the breach.

Default to plain pull_request. Use pull_request_target only when secrets are genuinely required, and never actions/checkout the PR head ref inside it. Sanitize every PR-author-controlled input via env vars rather than shell interpolation (run: echo "$TITLE" with env: TITLE: ${{ github.event.pull_request.title }}). Verify current best practice against the GitHub security blog before relying on this guidance.